SafeForge

SafeForge – Wo Apps mit Vertrauen gebaut werden SafeForge ist ein Open-Source-Mobile-App-Hub , der auf GitLab basiert und es Entwicklern ermöglicht, mobile Anwendungen in einem sicheren, KI-verifizierten und vollständig verschlüsselten Ökosystem zu entwickeln, hochzuladen, zu teilen und...

cfn_nag

Contesto Lo strumento cfn-nag cerca nei modelli CloudFormation pattern che potrebbero indicare infrastrutture non sicure. In parole povere, cerca: Regole IAM troppo permissive wildcard Regole per i security group troppo permissive wildcard Log di accesso non abilitati Crittografia non abilitata...

layne

Layne Layne ist eine selbst gehostete GitHub-App, die die Sicherheitsüberprüfung in all unseren Repositories zentralisiert. Da wir keine kommerziellen SAST/Secrets-Scanning-Tools verwenden und keinen Zugang zu GitHub Enterprise haben, kann es schwierig sein, verschiedene GitHub...

semgrep-rules

semgrep-rules Benvenuto! Questo repository contiene le regole della Community Edition di Semgrep. Oltre alle regole presenti in questo repository, il Semgrep Registry offre regole Pro proprietarie che garantiscono una copertura linguistica aggiuntiva e sbloccano analisi cross-file e dataflow...

oauth-scan

OAUTHScan Descrizione OAUTHScan è un'estensione per Burp Suite scritta in Java con lo scopo di fornire alcuni controlli di sicurezza automatici, che potrebbero essere utili durante i test di penetrazione su applicazioni che implementano gli standard OAUTHv2 e OpenID. Il plugin cerca varie...

fuzzing-templates

Modelli di Fuzzing Elenco curato dalla comunità di modelli di fuzzing per il motore nuclei per individuare vulnerabilità di sicurezza sconosciute. Documentazione • Contributi • Discussione • Comunità !Caution Questo repository è archiviato e incorporato nel progetto nuclei-templates nella directo...

nuclei-drupal-sa

nuclei-drupal-sa Template Nuclei per vulnerabilità Drupal... lontano dall'essere perfetto Fai una PR se vuoi che qualcosa cambi. Come si usa root@kitploit: nuclei -t ./nuclei-drupal-sa/templates/ --target https://www.example.com...

LAST

L.A.S.T. Strumento di scansione di sicurezza automatizzato per Linux l'ultimo strumento che userai mai! Questo strumento viene utilizzato per automatizzare il processo di ricognizione degli esercizi Red Team. Raccoglie tutte le informazioni e le riporta in un formato di facile lettura. Lo script ...

CVE-2026-16268

creationtimestamp| type| source ---|---|--- 2026-08-17 06:00:05+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-16268.yaml 2026-08-18 00:00:03+00:00| confirmed|...

GO-2026-6005 vulnerabilities

Vulnerabilities for packages: gitlab-operator-fips, gitlab-operator, tigera-operator-fips, datadog-agent-fips, datadog-agent, tigera-operator...

GO-2026-5597 vulnerabilities

Vulnerabilities for packages: packer-fips, cerbos, argo-cd-fips, skaffold-fips, rclone-fips, gitlab-rails-ce-fips, rancher-fleet, rclone, external-secrets-operator, syft-fips, argo-cd, syft, teleport, upwind-agent, seaweedfs-rocksdb-fips, flux, terragrunt-fips, gitlab-rails-ce, kyverno-fips,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: spire-server-fips, tkn, fulcio, kubescape, falcoctl-fips, flux-source-controller, oauth2-proxy, kots, timestamp-authority-fips, vexctl, cosign-fips, gitsign, dex, flux-kustomize-controller, aactl, tekton-chains, terragrunt, fulcio-fips, bank-vaults-fips, spire-server...

GO-2026-5547 vulnerabilities

Vulnerabilities for packages: flux-source-controller, tflint, chainloop-control-plane-fips, cosign-fips, neuvector-sigstore-interface-fips, kyverno-policy-reporter-plugins-kyverno, crossplane-fips, chainloop-cli-fips, gitsign, buildkitd-fips, gh, docker-fips, chainloop-cli, goreleaser,...

GO-2025-3527 vulnerabilities

Vulnerabilities for packages: docker-compose, kubescape...

GO-2026-4887 vulnerabilities

Vulnerabilities for packages: spire-server, docker-credential-gcr, podman, grafana, aws-otel-collector, skopeo, wolfictl, rancher-machine, buildah, opentelemetry-collector, apko, gatekeeper, kots, rancher, undock, opentelemetry-collector-contrib, trivy-operator, zot,...

GO-2025-4014 vulnerabilities

Vulnerabilities for packages: k3d, vertical-pod-autoscaler, gostatsd, wave, timescaledb-parallel-copy, istio, crossplane, rootlesskit, extism, harbor, mesosphere-vsphere-csi, etcd, kpt, kubernetes-csi-driver-hostpath, dagdotdev, rancher-telemetry, restic, amass, kustomize,...

GO-2024-3250 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, mc, argo-events, crossplane, bank-vaults, scorecard, crossplane-provider-azure-sql, tkn, gitsign, flux-source-controller, secrets-store-csi-driver-provider-azure, kots, flux-image-reflector-controller, policy-controller, buildkitd, cosign,...

CVE-2026-17632

CVE-2026-17632 affects IBM Langflow OSS versions 1.0.0–1.10.3. The vulnerability arises from improper validation of Python code during AST-based security scanning, enabling a remote authenticated attacker to execute arbitrary code. The NVD/CVE listings report a high-severity vector with CVSS 3.1:...

PYSEC-2026-1429 GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS

Summary GuardDog's safeextract function does not validate decompressed file sizes when extracting ZIP archives wheels, eggs, allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data...

CVE-2025-71375 picklescan - Undetected Remote Code Execution via _operator.methodcaller

picklescan before 0.0.34 fails to detect the operator.methodcaller built-in function when scanning pickle files for malicious code. Attackers can craft malicious pickle payloads using operator.methodcaller that evade detection and execute arbitrary code when loaded by pickle.load...